What is a SOC and why you need one

What is a SOC

A Security Operation Center (SOC) is a command center made up of skilled security personnel, processes and technologies to continuously monitor for malicious activity while preventing, detecting and responding to cyber incidents. Many industry experts refer to the SOC as a centralized command, aggregating telemetry across a company’s IT infrastructure, spanning network devices, computers and cloud applications. Over the last decade, the proliferation of threats has the industry adopting a layered approach to security resulting in numerous point products generating volumes of threat data to be monitored.

5 Benefits of a SOC

1. Reduce cybersecurity headcount costs
   Finding skilled candidates and hiring internally for most cyber related positions is a difficult task due mostly in part to the lack of security professional available for hire. In fact, the Cybersecurity Workforce Study Report by (ISC)², estimates that by 2021, the global cyber security skill shortage will exceed 4 million vacant job openings, and when you do find one, they aren’t cheap. Partnering with a SOC enables your business immediate access to security expertise without the financial burden of hiring internally.

2. Reduce dwell time & financial impact
   Dwell time is the period of time an attacker goes undetected on the network after initial access has occurred. Each minute an attacker dwells inside of the network, the greater the potential for damage. SOC’s shorten the dwell time from months down to minutes, reducing the financial impact when an intrusion does occur.

3. 24/7 continuous monitoring
   Adversaries don’t work 9-5, nor do they adhere to a traditional Monday-Friday 40-hour work week. Business are under relentless assault 24/7 and so should your security team. A 24/7 SOC does not stop when business owners are asleep, but rather proactively hunt and monitor for threat indicators, even throughout holidays and weekends. SOC monitoring around the clock keeps the threat radar circulating, hunting out advanced tactics, techniques and procedures to malicious hosts, networks and cloud artifacts, before a breach occurs.

4. Threat triage, remediation and incident isolation
   Numerous products throughout the ‘layers of security’ produce mountains of threat data. This is where security analysts perform triaging – the investigation process of determining whether a threat needs to be escalated to an incident status. Some SOC's provide remediation guidance, others offer a remediation solution to fix the threat and others offer a combination of the two. When a critical threat is escalated to an incident, in many cases the necessity of ‘containing’ the spread to other devices is vital, this is where device isolation comes into play. Today’s modern day SOC has the capability to isolate and contain the threat until the remedy is applied.

5. Security stack insight & compatibility
   Most manage service providers have an existing stack of security technologies where vendor selections and investments have already transpired. This includes firewalls, next-gen antivirus, email security, DNS, authentication, etc. Working with a SOC that supports your existing layers of security (stack) delivers immediate insight across major attack vectors while consolidating the threat telemetry in one single pane of glass, and across the fleet of managed customers.

Additional benefits of a SOC service

• Log management and storage retention
• Threat correlation with events and intel
• Forensic investigation capabilities
• Reduce technology stack investments
• Remote home worker threat coverage  

Conclusion: A SOC helps your business

Think of a SOC as an extension to your existing MSP’s provider or internal IT team to expand your capabilities to detect and respond to threats around the clock. Partnering with a SOC reduces significant financial costs of hiring and retaining an internal team of cyber security personnel.

To learn more about NCI’s Cybersecurity service, please visit our website.